Microsoft Windows SMB : Obtains the Password Policy

Using the supplied credentials it was possible to extract the password policy for the remote Windows host. The password policy must conform to the Informational System Policy. C Tenable Network Security, Inc. Requested by Michael Richardson include"compat.inc"; if description scriptid17651;...

Portcullis Security Advisory 05-007

Portcullis Security Advisory Vulnerable System: Webseries Payment Application Vulnerability Title: Password Policy Implemented At Client rather than Server Vulnerability discovery and development: Portcullis Security Testing Services Affected systems: Bottomline Webseries Payment Application...

USN-58-1: MIT Kerberos server vulnerability

Michael Tautschnig discovered a possible buffer overflow in the addtohistory function in the MIT Kerberos 5 implementation. Performing a password change did not properly track the password policy's history count and the maximum number of keys. This could cause an array overflow and may have allow...

CVE-2004-1189

The addtohistory function in svrprincipal.c in libkadm5srv for MIT Kerberos 5 krb5 up to 1.3.5, when performing a password change, does not properly track the password policy's history count and the maximum number of keys, which can cause an array index out-of-bounds error and may allow...

CVE-2004-1189

The addtohistory function in svrprincipal.c in libkadm5srv for MIT Kerberos 5 krb5 up to 1.3.5, when performing a password change, does not properly track the password policy's history count and the maximum number of keys, which can cause an array index out-of-bounds error and may allow...

CVE-2004-1189

The addtohistory function in svrprincipal.c in libkadm5srv for MIT Kerberos 5 krb5 up to 1.3.5, when performing a password change, does not properly track the password policy's history count and the maximum number of keys, which can cause an array index out-of-bounds error and may allow...

CVE-2002-0443

Technical details about CVE-2002-0443 are not publicly available in the provided documents. The materials include the vulnerability description but do not specify affected products/versions, root cause, exploit details, or remediation.

Default Password (glftpd) for 'glftpd' Account

The account 'glftpd' has the password 'glftpd'. An attacker may use this to gain further privileges on this system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "glftpd"; password = "glftpd"; include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid11258;...

Unpassworded 'jill' Account

The account 'jill' has no password set. An attacker may use this to gain further privileges on this system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "jill"; include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid11266; scriptversion"1.34";...

CVE-2002-0421

The CVE-2002-0421 entry concerns Microsoft IIS 4.0 on Windows NT where local users can bypass the password policy by directly invoking password-changing programs in the /iisadmpwd directory. The affected components are the .htr programs: aexp2.htr, aexp2b.htr, aexp3.htr, and aexp4.htr. The root c...

CVE-2002-0421

IIS 4.0 allows local users to bypass the "User cannot change password" policy for Windows NT by directly calling .htr password changing programs in the /iisadmpwd directory, including 1 aexp2.htr, 2 aexp2b.htr, 3 aexp3.htr , or 4 aexp4.htr...

Microsoft Windows - Local Users Information : Passwords Never Expire

Using the supplied credentials, Nessus was able to list local users that are enabled and whose passwords never expire. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10916; scriptversion"1.23"; scriptcvsdate"Date: 2018/08/13 14:32:39"; scriptnameenglish:"Microsoft...

Microsoft Windows - Users Information : Can't Change Password

Using the supplied credentials, Nessus was able to list users who can not change their own passwords. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10896; scriptversion"1.20"; scriptcvsdate"Date: 2018/08/13 14:32:39"; scriptnameenglish:"Microsoft Windows - Users...

Microsoft SQL Server Default Credentials

The SQL Server has a common password for one or more accounts. These accounts may be used to gain access to the records in the database or even allow remote command execution. %NASLMINLEVEL 70300 MSSQL Brute Forcer This script checks a SQL Server instance for common username and password...

Microsoft IIS /iisadmpwd/aexp2.htr Password Policy Bypass

Microsoft IIS installs the 'aexp2.htr', 'aexp2b.htr', 'aexp3.htr', or 'aexp4.htr' files in the '/iisadmpwd' directory by default. These fiels can be used by an attacker to brute-force a valid username/password. A valid user may also use it to change his password on a locked account, bypassing...

CVE-1999-0535

A Windows NT account policy for passwords has inappropriate, security-critical settings, e.g. for password length, password age, or uniqueness...

PT-1998-1091 · Microsoft · Windows Nt

Name of the Vulnerable Software and Affected Versions: Windows NT affected versions not specified Description: The issue concerns a Windows NT domain where a user or administrator account has a password that can be easily guessed. Recommendations: For all affected versions, ensure that strong,...